Test Evaluator ATM Skimmer Detection in your own Azure

What you are testing

Evaluator ATM Skimmer Detection analyzes short event clips from your ATM, point-of-sale and fuel-pump cameras and flags card-reader tampering: someone fitting a skimmer, overlay, insert or other foreign device to the machine, or repeatedly manipulating the card reader. Each result comes with the model's reasoning and the clip, so a person can check it before acting.

It installs as a managed application in your own Azure subscription: a web dashboard, storage for clips and results, and an AI engine that runs on an Azure confidential VM with an NVIDIA H100 GPU in confidential mode. Your clips and detection results stay in your subscription.

The trial at a glance

Before you start

1. Azure permissions

You need Owner or Contributor on the subscription, or on the resource group you will install into. The install creates its own resource group (the "managed resource group") for everything it deploys.

2. Microsoft Entra permissions

Dashboard sign-in uses one app registration in your directory, which you create in Step 1. You can create it if your organization lets users register applications, or if you hold a role such as Application Developer. Granting consent for the whole organization needs an admin role such as Cloud Application Administrator; without it, each person is asked to consent at their first sign-in (if your organization allows that).

3. GPU quota: request it first

The engine runs on the confidential H100 VM size Standard_NCC40ads_H100_v5, which exists in only three regions. Each running engine instance needs 40 vCPUs of quota.

1. In the Azure portal, search for Quotas and open Compute.
2. Filter by NCC and by the region you will use: Central US, East US 2 or West Europe.
3. Select Standard NCCads2023 Family vCPUs and request a new limit of 40.

4. Test clips

• Format: MP4, AVI or MOV; up to 200 MB and 10 minutes each.
• Best results: one event per clip, 50 seconds or under, as your cameras or video management system record them. Longer clips are analyzed in full, in segments.
• For a fair test: include normal visits as well as tampering, use your usual camera angles, and avoid heavily re-compressed copies (for example, clips forwarded through messaging apps).
• Privacy: uploaded clips stay in your Azure subscription.

5. Time and budget

Plan about 2 hours for the first session, once quota is granted: Step 1 takes about 15 minutes, the install about 20, sign-in about 5, the first engine start 20–25, then testing. Budget about $20 in Azure for a same-day trial (see What the trial costs).

1. Register. In the Azure portal, search for App registrations → New registration.
   • Name: Evaluator ATM Skimmer Dashboard
   • Supported account types: Accounts in this organizational directory only (Single tenant)
   • Redirect URI: leave empty for now (you add it in Step 3).
   Click Register, then copy the Application (client) ID from the Overview page.
2. Manifest. Under "api", set "requestedAccessTokenVersion": 2 and click Save. (In the older manifest view, set "accessTokenAcceptedVersion": 2.) If you skip this, sign-in works but every page says access is denied.
3. Expose an API. Next to Application ID URI, click Add, keep the proposed api://<client ID> and Save. Then Add a scope: scope name access_as_user; who can consent Admins and users; display name Use the ATM Skimmer Detection dashboard; description Lets the dashboard call its own API as the signed-in user.; state Enabled.
4. App roles. Click Create app role five times. For each: allowed member types Users/Groups, tick Enable this app role, and type the Value exactly as shown:

   Display name	Value	What it allows
   Skimmer Admin	Skimmer.Admin	Everything, including configuration and users
   Skimmer Analyst	Skimmer.Analyst	Detections, clip review, acknowledging, uploads
   Skimmer Operator	Skimmer.Operator	Health, throughput and scaling; no video
   Skimmer Auditor	Skimmer.Auditor	Read-only detections, clips and audit log
   Skimmer Reviewer	Skimmer.Reviewer	Skimmer detections and their clips only

5. API permissions → Add a permission. Microsoft Graph → Delegated: tick openid, profile, offline_access. Then My APIs → Evaluator ATM Skimmer Dashboard: tick access_as_user. Finally click Grant admin consent (needs an admin role).
6. Assign yourself. On the Overview page, open the link under Managed application in local directory. In Properties, set Assignment required? to Yes and save. In Users and groups → Add user/group, select yourself and the role Skimmer Admin. Nobody becomes an admin automatically.

Open the offer in Azure Marketplace (or search Evaluator ATM Skimmer Detection there) and click Create. The wizard has five tabs:

1. In the Azure portal, open Managed applications → your application → Parameters and Outputs, and copy dashboardUrl. Open it in your browser.
2. Until sign-in works, the page itself shows what is left. It gives the exact address with a Copy button, a button to your app registration, and a live check that turns green when the address is registered.
3. In the app registration: Authentication → Add a platform → Single-page application → paste the address exactly (it starts with https:// and has no / at the end) → Configure. Use Single-page application, not Web.
4. Back on the dashboard, sign in with the account that holds Skimmer Admin.

1. On the dashboard, open Setup and click Start engine under Start the detection engine. The confirmation shows the hourly GPU rate for your region.
2. The status at the top changes from Engine off to Starting… and then Engine on, with a running time and cost counter.
3. The first start prepares the confidential VM, downloads the encrypted engine and releases the model's key only to that attested VM. Later starts take about 11 minutes if you keep the engine's disk (Step 7).

1. Wait for Engine on, then open Analyze clip.
2. Drop one or more clips on the page, or click to browse. They are uploaded and analyzed one after another.
3. Each result shows:
   • the category: Skimmer placement or Normal transaction;
   • the confidence: High, or Borderline · review when the call is close;
   • the segments analyzed and the time taken;
   • the model's reasoning in plain words.

1. ATMs page → Enroll an ATM: give each device an ID (for example ATM-0047) and its site, bank, region and type. Point-of-sale terminals and fuel pumps are enrolled the same way. Only enrolled IDs are accepted.
2. Integrations → Generate upload credential: a write-only credential for the private intake storage.
3. Configure your camera or video management system (or Evaluator Proximity Monitor) to upload each event clip to incoming/<device ID>/<clip>.mp4. The folder is the device ID, so every clip is tagged by where it was uploaded.
4. Results appear on Live feed (every clip) and Detections (skimmer placements, with Review and Ack).
5. Alerts: on Setup or Integrations, configure a webhook, Microsoft Sentinel, Splunk or CEF syslog and click Send test. Changes apply within about a minute, with no redeploy.

Billing counts each enrolled device that sent clips that day. Remove a device on the ATMs page and its clips are no longer accepted, so it drops out of the count from the next day.

1. Stop: click Stop at the top of the dashboard (or on Setup) and confirm Stop engine. The status shows Engine off once Azure confirms it.
   • By default the engine's disk is kept (encrypted data only), so the next start takes about 11 minutes. It costs about $35–42 a month.
   • Tick Delete the engine VM instead if you will not restart soon: no disk charge, but the next start takes about 20 minutes again.
2. Delete when you are done: Azure portal → Managed applications → your application → Delete. This removes everything it created, including your clips and results. It takes about 35 minutes. You can also delete the app registration from Step 1.

What the trial costs

There are two separate charges: Azure infrastructure, billed by Microsoft to your subscription, and the Evaluator fee, which applies only to connected devices.

Azure pay-as-you-go list prices from September 2026, measured on real test installs. Your agreement, region and usage change the total.

How your data is handled

• Your subscription: clips and detection results are stored in your Azure subscription. Evaluator does not receive them.
• Confidential computing: the model and the video frames it analyzes are processed in encrypted memory that the Azure host cannot read. Clips and results at rest use Azure encryption.
• Protected model: the model is delivered encrypted, and its key is released only to an attested confidential VM of your installation.
• Access control: sign-in is through your Microsoft Entra ID, with five roles, and clip views and changes are recorded in an audit log.
• Publisher access, disclosed: Evaluator's license service holds Contributor access to the installation's managed resource group, to deliver the encrypted engine. Every change it makes appears in your Azure Activity Log. Our security disclosure for version 1.0 explains this and the other known limits; ask us for a copy.

Privacy policy: evaluatorsecurity.com/privacy

If something does not work